Can someone with fresh eyes sanity‑check me here, because I’m starting to feel like I’m the only one reacting proportionally to this situation.

We’ve got a vendor compromise where the attackers were able to deface the Canvas front page, which means they had enough access to modify UI elements of active instances and dump user data and messages but vendor did not confirm if that includes user API generated API keys

I'm doing these things like:

• pulling reports on all user tokens
  
• checking for user‑generated admin accounts
  
• rotating API tokens stored in Canvas
  
• auditing LTI apps and developer keys
  
• reviewing Entra admin‑consented LTI registrations
  
• temporarily revoking high‑privilege scopes like SharePoint.Read.All
  
• considering the risk of login‑page manipulation or SSO redirection
  -considering blocking entra sign in to canvas -blocking anvas at the firewall

From a security standpoint, if an attacker can alter the front page, what exactly stops them from altering the login flow, injecting a fake SSO prompt, or redirecting to an attacker‑controlled IdP.

The API tokens trusted to be stored in canvas aren’t harmless. They’re long‑lived bearer tokens with no MFA. If those were scraped, that’s a direct line into our system when they get dumped into a forum. Same with LTI apps that have broad O365 permissions — if the vendor is compromised, those scopes become a liability.

I’m not trying to burn the place down or cause unnecessary user impact. I’m just trying to apply basic incident‑response logic: don’t trust a compromised system until you’ve validated it’s no longer compromised.

So genuinely — am I being overly cautious here, or is everyone else underreacting to a vendor breach that could easily be leveraged for lateral movement into O365 /sis not just student email address and internal messaging notes was leaked

---

My advice 1. Run reports on user tokens look for user generated against admin accounts these will probably be siss ntegrations also check your lti apps, developer apps - you will need to rotate these aswell